# Office365 / Azure audit log collector

**URL:** <https://community.graylog.org/t/office365-azure-audit-log-collector/23167>\
**Category:** Other Solutions\
**Tags:** other\_solutions\
**Created:** [March 24, 2022, 4:25pm UTC](https://community.graylog.org/t/office365-azure-audit-log-collector/23167 "2022-03-24T16:25:35Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![dscryber](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/dscryber/32/14178_2.png) [@dscryber](https://community.graylog.org/u/dscryber)\
**Post date:** [March 24, 2022, 4:25pm UTC](https://community.graylog.org/t/office365-azure-audit-log-collector/23167/1 "2022-03-24T16:25:35Z")

</div>

## Office365 / Azure audit log collector

@ddbnl

[View on Github](https://github.com/ddbnl/office365-audit-log-collector)  
[Open Issues](https://github.com/ddbnl/office365-audit-log-collector/issues)  
[Stargazers](https://github.com/ddbnl/office365-audit-log-collector/stargazers)

## Use cases:

- Ad-lib log retrieval;
- Scheduling regular execution to retrieve the full audit trail.

## Features:

- Subscribe to the audit logs of your choice through the subscription script;
- Collect General, Exchange, Sharepoint, Azure active directory and/or DLP audit logs through the collector script;
- Output to file or to a Graylog input (i.e. send the logs over a network socket)

## Requirements:

- Office365 tenant;
- Azure application created for this script (see instructions)
- AzureAD tenant ID;
- Client key of the new Azure application;
- Secret key (created in the new Azure application, see instructions);
- App permissions to access the API’s for the new Azure application (see instructions);
- Subscription to the API’s of your choice (General/Sharepoint/Exchange/AzureAD/DLP, run AuditLogSubscription script and follow the instructions).

---

<div class="post-metadata">

**Author:** ![ddbnl](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ddbnl/32/11443_2.png) [@ddbnl](https://community.graylog.org/u/ddbnl)\
**Post date:** [April 14, 2022, 7:34am UTC](https://community.graylog.org/t/office365-azure-audit-log-collector/23167/2 "2022-04-14T07:34:47Z")

</div>

I made a bunch of changes to this tool [on its’ Github page](https://github.com/ddbnl/office365-audit-log-collector) to make it easier to use and more robust. Also added more detailed onboarding instructions.

If anyone has any questions or issues with it let me know on Github or here 🙂

---

<div class="post-metadata">

**Author:** ![dscryber](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/dscryber/32/14178_2.png) [@dscryber](https://community.graylog.org/u/dscryber)\
**Post date:** [April 18, 2022, 5:44pm UTC](https://community.graylog.org/t/office365-azure-audit-log-collector/23167/3 "2022-04-18T17:44:58Z")

</div>

Thanks much for the update, @ddbnl . Let me know if you’d like the community help you announce your updates. If you’re interested, send me email at [david.sciuto@graylog.com](mailto:david.sciuto@graylog.com)

---

<div class="post-metadata">

**Author:** ![ddbnl](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ddbnl/32/11443_2.png) [@ddbnl](https://community.graylog.org/u/ddbnl)\
**Post date:** [May 6, 2022, 7:38am UTC](https://community.graylog.org/t/office365-azure-audit-log-collector/23167/4 "2022-05-06T07:38:24Z")

</div>

As a heads up, I’ve rewritten the engine of the log collector in Rust, and in my own tests it’s been at least 10 times faster. In terms of using it everything is the same, it should just be faster.

I’ve also added a ‘timestamp’ field to every log (copy from a field called CreationTime present in every audit log) to make it easier to use with Graylog.

If you have a large tenant and had long run times it’s worth trying the latest executable.

---

<div class="post-metadata">

**Author:** ![BertCurbit](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/bertcurbit/32/14326_2.png) [@BertCurbit](https://community.graylog.org/u/BertCurbit)\
**Post date:** [January 24, 2024, 11:07am UTC](https://community.graylog.org/t/office365-azure-audit-log-collector/23167/5 "2024-01-24T11:07:56Z")

</div>

Hi, bit late to the party but it’s a great engine!  
Are there any Dashboards available to download?